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DETAILED ACTION 

Claim Rejections - 35 USC § 103 

1 . The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

2. Claims 1, 4-5, 7, 10, 13-16 and 19-21 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Hrabik et al., (US Publication No. 2002/0178383), (hereinafter 
Hrabik), and further in view of Albitz et al., (DNS and BIND), (hereinafter Albitz). 

Regarding claim 1, Hrabik discloses determining a first mapping in a domain naming 
system [Hrabik, paragraph 69, lines 4-7], the act of determining the first mapping 
comprising an act of obtaining an authoritative mapping from an authoritative source 
[Hrabik, paragraph 69]; 

determining a second mapping in the domain naming system [Hrabik, paragraph 69], 
the act of determining a second mapping comprising acts of querying a nameserver of 
the list of nameservers to be queried and receiving a response from the nameserver, 
the response containing the second mapping [Hrabik, paragraph 69], wherein the first 
mapping is a first namespace mapping that maps a first name to a first resource and the 
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second mapping is a second namespace mapping that maps a second name to a 
second resource [Hrabik, paragraph 69]; 

comparing the first mapping to the second mapping [Hrabik, paragraph 69] and 
identifying at least one discrepancy between the first and second mapping [Hrabik, 

paragraphs 15 and 29]; and 

generating and sending an alert message to a user, the alert message indicating the at 
least one discrepancy between the first and second mapping [Hrabik, paragraphs 15, 29 
and 69]. 

Hrabik does not specifically disclose compiling a list of nameservers to be queried 
comprising acts of: 

sending a namespace mapping resolution query to a plurality of network nodes; 

waiting for one or more responses from the plurality of network nodes; 

determining whether a network node in the plurality of network nodes is a nameserver 

based on a format of one or more responses received from the network node; and 

if the network node is a nameserver, adding the network node to the list of nameservers 

to be queried. 

However, Albitz discloses creating a list of nameservers [Albitz, page 220, Zone 
Transfers, 1^' paragraph and page 220, Zone Transfers, paragraph 3, lines 2-3]. 
It would have been obvious to one having ordinary skill in the art at the time the 
invention was made to incorporate creating a list of nameservers in order to assist in the 
testing of name resolution and allow for maintaining records of nameservers to check / 
verify again. 
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Albitz further discloses sending a namespace mapping resolution query to a plurality of 
network nodes [Albitz, page 220, Zone Transfers, 1^' paragraph, 'nslookup can be used 
to transfer a whole zone using the Is command', page 221 , line 26, '> Is -t any 
movie.edu > /tmp/movie - List all data into /tmp/movie', from the list starting on line 29, 
you can see the mapping resolution from hostnames to ip address and the type of 
server, i.e. 'NS' identifies a nameserver, 'MX' identifies a mailserver]; 
waiting for one or more responses from the plurality of network nodes [Albitz, page 220, 
Zone Transfers, 1®' paragraph, 'nslookup can be used to transfer a whole zone using 
the Is command', page 221 , line 26, '> Is -t any movie.edu > /tmp/movie - List all data 
into /tmp/movie', after typing in the request, the response will print out on screen or to a 
file as requested in this example, from the list starting on line 29, you can see the 
mapping resolution from hostnames to ip address and the type of server, i.e. 'NS' 
identifies a nameserver, 'MX' identifies a mailserver]; 

determining whether a network node in the plurality of network nodes is a nameserver 
[Albitz, page 220, Zone Transfers, 1^' paragraph, 'nslookup can be used to transfer a 
whole zone using the Is command', page 221 , line 26, '> Is -t any movie.edu > 
/tmp/movie - List all data into /tmp/movie', from the list starting on line 29, you can see 
the mapping resolution from hostnames to ip address and the type of server, i.e. 'NS' 
identifies a nameserver, 'MX' identifies a mailserver] based on a format of one or more 
responses received from the network node [Albitz, page 220, Zone Transfers, 1®' 
paragraph, 'nslookup can be used to transfer a whole zone using the Is command', 
page 221 , line 26, '> Is -t any movie.edu > /tmp/movie - List all data into /tmp/movie'. 
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from the list starting on line 29, you can see the mapping resolution from hostnames to 
ip address and the type of server, i.e. 'NS' identifies a nameserver, 'MX' identifies a 
mailserver]; and 

if the network node is a nameserver, adding the network node to the list of nameservers 
to be queried [Albitz, page 220, Zone Transfers, 1®' paragraph and page 220, Zone 
Transfers, paragraph 3, lines 2-3]. 

Regarding claim 4, Hrabik-Albitz further discloses the authoritative source is at least one 
of: an authoritative nameserver; and a database storing a plurality of authoritative 
mappings [Hrabik, paragraph 69, lines 3-7]. 

Regarding claim 5, Hrabik-Albitz further discloses an act of reporting the at least one 
discrepancy to a user [Hrabik, paragraphs 15, 29 and 69]. 

Regarding claim 7, Hrabik-Albitz further discloses the first namespace mapping is 
stored on an authoritative nameserver and the act of determining a first mapping 
comprises an act of obtaining the first mapping from the authoritative nameserver 
[Hrabik, paragraph 69]. 

Regarding claim 10, Hrabik-Albitz further discloses the act of querying a nameserver 
comprises an act of requesting at least one namespace mapping record from the 
nameserver [Hrabik, paragraph 69]. 



Application/Control Number: 10/689,559 
Art Unit: 2445 



Pages 



Regarding claim 1 3, Hrabik-Albitz further discloses the act of determining comprises an 
act of determining that a network node in the plurality of nodes is not a nameserver if 
the network node does not respond to the namespace mapping resolution query [Albitz, 
page 220, Zone Transfers, 1^' paragraph, 'nslookup can be used to transfer a whole 
zone using the Is command', page 221 , line 26, '> Is -t any movie.edu > /tmp/movie - 
List all data into /tmp/movie', from the list starting on line 29, you can see the mapping 
resolution from hostnames to ip address and the type of server, i.e. 'NS' identifies a 
nameserver, 'MX' identifies a mailserver]. 

Regarding claim 14, Hrabik-Albitz further discloses the act of compiling a list of at least 
one nameserver comprises an act of: listening for a request from a non-authoritative 
nameserver to an authoritative nameserver [Albitz, page 217, paragraph 4, lines 1-4, 
'When a BIND name server gets a query, it looks for the answer in its cache. If it 
doesn't have the answer, and it is authoritative for the domain, the name server 
responds that the name doesn't exist or that there is no data for that type.', paragraph 
5, lines 4-6, When the name server receives a response from one of the remote name 
servers, it caches the response]; and when the request is detected, adding the non- 
authoritative nameserver to a list of nameservers, [Albitz, page 217, paragraph 5, lines 
4-6, 'When the name server receives a response from one of the remote name servers, 
it caches the response', caching the response is adding the nameserver to a list of 
nameservers to use in the future]. 
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Regarding claim 15, Hrabik-Albitz further discloses the request is a resolve request 
[Albitz, page 21 1, from nslookup routine, 'slate.mines.Colorado.edu.' provides a first 
mapping, from paragraph 1, this is an authoritative lookup]. 

Regarding claim 16, Hrabik-Albitz further discloses sending a namespace mapping 
resolution query to a plurality of network nodes [page 220, Zone Transfers, 1®' 
paragraph, 'nslookup can be used to transfer a whole zone using the Is command', 
page 221 , line 26, '> Is -t any movie.edu > /tmp/movie - List all data into /tmp/movie', 
from the list starting on line 29, you can see the mapping resolution from hostnames to 
ip address and the type of server, i.e. 'NS' identifies a nameserver, 'MX' identifies a 
mailserver] from a monitoring computer system that monitors namespace mapping 
violations [Hrabik, paragraphs 11 and 14]; 

waiting for one or more responses from the plurality of network nodes [page 220, Zone 
Transfers, 1^' paragraph, 'nslookup can be used to transfer a whole zone using the Is 
command', page 221 , line 26, '> Is -t any movie.edu > /tmp/movie - List all data into 
/tmp/movie', after typing in the request, the response will print out on screen or to a file 
as requested in this example, from the list starting on line 29, you can see the mapping 
resolution from hostnames to ip address and the type of server, i.e. 'NS' identifies a 
nameserver, 'MX' identifies a mailserver]; 

determining whether a network node in the plurality of network nodes is a nameserver 
[page 220, Zone Transfers, 1^' paragraph, 'nslookup can be used to transfer a whole 
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zone using the Is command', page 221 , line 26, '> Is -t any movie.edu > /tmp/movie - 
List all data into /tmp/movie', from the list starting on line 29, you can see the mapping 
resolution from hostnames to ip address and the type of server, i.e. 'NS' identifies a 
nameserver, 'MX' identifies a mailserver]; and 

storing, in a storage device in the monitoring computer system, an indication that the 
network node is a nameserver in response to the act of determining [page 220, Zone 
Transfers, 1®' paragraph, 'nslookup can be used to transfer a whole zone using the Is 
command', page 221 , line 26, '> Is -t any movie.edu > /tmp/movie - List all data into 
/tmp/movie', from the list starting on line 29, you can see the mapping resolution from 
hostnames to ip address and the type of server, i.e. 'NS' identifies a nameserver, 'MX' 
identifies a mailserver], the indication of the network node being stored in a list of 
nameservers to be queried by the monitoring computer system to determine 
namespace mapping violations [Hrabik, paragraphs 15, 29 and 69]; 
determining a first mapping in a domain naming system, the act of determining the first 
mapping comprising an act of obtaining an authoritative mapping from an authoritative 
source [Hrabik, paragraph 69]; 

determining a second mapping in the domain naming system, the act of determining a 
second mapping comprising acts of querying a nameserver of the list of nameservers to 
be queried and receiving a response from the nameserver, the response containing the 
second mapping, wherein the first mapping is a first namespace mapping that maps a 
first name to a first resource and the second mapping is a second namespace mapping 
that maps a second name to a second resource [Hrabik, paragraph 69]; 



Application/Control Number: 10/689,559 Page 9 

Art Unit: 2445 

comparing tlie first mapping to the second mapping and identifying at least one 
discrepancy between the first and second mapping [Hrabik, paragraphs 15, 29 and 69]; 
generating and sending an alert message to a user, the alert message indicating the at 
least one discrepancy between the first and second mapping [Hrabik, paragraphs 15, 29 
and 69]. 

Regarding claim 19, Hrabik-Albitz further discloses listening for a request from a non- 
authoritative nameserver to an authoritative nameserver [Albitz, page 217, paragraph 5, 
lines 4-6, When the name server receives a response from one of the remote name 
servers, it caches the response]; 

when the request is detected, adding the non-authoritative nameserver to a list of 
nameservers [Albitz, page 217, paragraph 5, lines 4-6, When the name server receives 
a response from one of the remote name servers, it caches the response]; and 
storing the list of nameservers in a memory of a monitoring computer system [Albitz, 
page 217, paragraph 5, lines 4-6, When the name server receives a response from one 
of the remote name servers, it caches the response], the list of nameservers to be 
queried by the monitoring computer system to determine namespace mapping 
violations [Hrabik, paragraphs 15, 29 and 69]; 

determining a second mapping in the domain naming system, the act of determining a 
second mapping comprising acts of querying a nameserver of the list of nameservers to 
be queried and receiving a response from the nameserver, the response containing the 
second mapping, wherein the first mapping is a first namespace mapping that maps a 
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first name to a first resource and the second mapping is a second namespace mapping 
that maps a second name to a second resource [Hrabik, paragraph 69]; 
comparing the first mapping to the second mapping and identifying at least one 
discrepancy between the first and second mapping [Hrabik, paragraphs 15, 29 and 69]; 
generating and sending an alert message to a user, the alert message indicating the at 
least one discrepancy between the first and second mapping [Hrabik, paragraphs 15, 29 
and 69]. 

Regarding claim 20, Hrabik-Albitz further discloses the request is a resolve request 
[Albitz, page 21 1, from nslookup routine, 'slate.mines.Colorado.edu.' provides a first 
mapping, from paragraph 1, this is an authoritative lookup]. 

Regarding claim 21 , Hrabik-Albitz further discloses a detector adapted to determine a 
first mapping and a second mapping [Hrabik, paragraph 69] wherein the detector is 
further adapted to compare the first mapping to the second mapping [Hrabik, paragraph 
69] and to identify at least one discrepancy between the first mapping and second 
mapping [Hrabik, paragraphs 15 and 29], wherein the detector is configured to obtain an 
authoritative mapping from an authoritative source and store the authoritative mapping 
in a database [Hrabik, paragraphs 44 and 69]; 

a discoverer adapted to discover at least one nameserver among a plurality of network 
nodes [Albitz, page 220, Zone Transfers, 1®' paragraph, 'nslookup can be used to 
transfer a whole zone using the Is command', page 221 , line 26, '> Is -t any movie.edu 
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> /tmp/movie - List all data into /tmp/movie', from the list starting on line 29, you can 
see the mapping resolution from hostnames to ip address and the type of server, i.e. 
'NS' identifies a nameserver, 'MX' identifies a mailserver]; 
a database configured to store the first mapping and the second mapping [Hrabik, 
paragraphs 44 and 69] and a list of a plurality of discovered nameservers [Hrabik, 
paragraphs 44 and 69], including the at least one nameserver, wherein the detector is 
configured to query the at least one nameserver [Hrabik, paragraph 69], and 
store the second mapping contained within a response received from the nameserver 
[Albitz, page 217, paragraph 5, lines 4-6, When the name server receives a response 
from one of the remote name servers, it caches the response], 
wherein the discoverer is adapted to send a namespace mapping resolution query to a 
plurality of network nodes [Hrabik, paragraph 69], wait for one or more responses from 
the plurality of network nodes [Hrabik, paragraph 69], determine whether a network 
node in the plurality of network nodes is a nameserver based on a format of one or 
more responses received from the network node [Hrabik, paragraph 69], and if the 
network node is a nameserver, storing the network node to the list of nameservers to be 
queried [Hrabik, paragraph 69]; and 

a component adapted to generate an alert message and send the alert message to a 
user, the alert message indicating the at least one discrepancy between the first 
mapping and the second mapping [Hrabik, paragraphs 15, 29 and 69]. 
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Response to Arguments 

3. Applicant's arguments filed 08/03/2009 have been fully considered but they are 
not persuasive. 

A - Applicant argues "neither Hrabik or Albitz teach or suggest either: 'comparing the 
first mapping to the second mapping and identifying at least one discrepancy between 
the first and second mapping' or 'a detector further adapted to compare the first 
mapping to the second mapping and to identify at least one discrepancy between the 
first mapping and the second mapping'". 

A - Hrabik discloses verifying www.company.com access the proper web site. It is 
obvious that in order to verify the name of the URL request, it is compared against an IP 
address that is known to be correct from the verifying system and tested against the IP 
address that the test is sent to [Hrabik, paragraph 69, lines 12-15]. Additionally, Hrabik 
discloses that when testing or discrepancies are found, that a message is sent to the 
master system [Hrabik, at least paragraphs 15, 24 and 29]. 

Conclusion 

4. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
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TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

Examiner's Note: Examiner has cited particular paragraphs / columns and line numbers 
in the reference(s) applied to the claims above for the convenience of the applicant. 
Although the specified citations are representative of the teachings of the art and are 
applied to specific limitations within the individual claim, other passages and figures 
may apply as well. It is respectfully requested from the applicant in preparing 
responses, to fully consider the references in entirety as potentially teaching all or part 
of the claimed invention, as well as the context of the cited passages as taught by the 
prior art or relied upon by the examiner. 

Should applicant amend the claims of the claimed invention, it is respectfully requested 
that applicant clearly indicate the portion(s) of applicant's specification that support the 
amended claim language for ascertaining the metes and bounds of applicant's claimed 
invention 
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Any inquiry concerning tliis communication or earlier communications from the 
examiner should be directed to WILLIAM J. GOODCHILD whose telephone number is 
(571 )270-1589. The examiner can normally be reached on Monday - Friday / 8:00 AM - 
4:00 PM EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Vivek Srivastava can be reached on (571) 272-7304. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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10/27/2009 

A/IVEK SRIVASTAVA/ 

Supervisory Patent Examiner, Art Unit 2445 



